mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 00:28:21 +00:00
369e42a6e4
Due to different double precision on M1, file IDs for SMB could end up changing on M1 because the access time of a file goes into their computation. The real solution for this would be changing Zeek's internal "time" representation to uint64; that's planned, but requires major surgery. For now, this PR changes the SMB code to also pass SMB's original time representation (which is a uint64) into script-land, and then use that for computing the file ID. Closes #1406
11 lines
843 B
Text
11 lines
843 B
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path files
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts fuid tx_hosts rx_hosts conn_uids source depth analyzers mime_type filename duration local_orig is_orig seen_bytes total_bytes missing_bytes overflow_bytes timedout parent_fuid md5 sha1 sha256 extracted extracted_cutoff extracted_size
|
|
#types time string set[addr] set[addr] set[string] string count set[string] string string interval bool bool count count count count bool string string string string string bool count
|
|
XXXXXXXXXX.XXXXXX FwL5Z01az5ZsFYcHh5 10.0.0.11 10.0.0.12 CHhAvVGS1DHFjwGM9 SMB 0 (empty) application/pdf WP_SMBPlugin.pdf 0.073970 - T 1508939 - 0 0 F - - - - - - -
|
|
#close XXXX-XX-XX-XX-XX-XX
|